Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644)

let SuspiciousProcs = dynamic(["cmd.exe","powershell.exe","powershell_ise.exe","cscript.exe","wscript.exe","mshta.exe","certutil.exe","rundll32.exe","regsvr32.exe","net.exe","whoami.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (SuspiciousProcs)
| where InitiatingProcessCommandLine has_any ("SharePoint", "MSSharePoint", "SPWebApplication", "w3wp")
| extend PoolHint = extract(@"-ap\s+\"?([A-Za-z0-9_\-]+)\"?", 1, InitiatingProcessCommandLine)
| where PoolHint has "SharePoint" or InitiatingProcessFolderPath has "SharePoint"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId
| order by TimeGenerated desc

index=sysmon OR index=edr EventCode=1 ParentImage="*\\w3wp.exe*"
| search ParentCommandLine="*SharePoint*" OR ParentCommandLine="*MSSharePoint*"
| search Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\cscript.exe", "*\\wscript.exe", "*\\mshta.exe", "*\\certutil.exe", "*\\rundll32.exe", "*\\regsvr32.exe", "*\\net.exe", "*\\whoami.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by host, ParentImage, ParentCommandLine, Image, CommandLine, User
| where count > 0
| sort -last_seen

sequence by host.name with maxspan=5m
  [process where event.type == "start" and process.name : "w3wp.exe" and process.command_line : "*SharePoint*"] by process.entity_id
  [process where event.type == "start" and process.parent.name : "w3wp.exe" and
    process.name : ("cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "certutil.exe", "rundll32.exe", "regsvr32.exe", "net.exe", "whoami.exe")] by process.parent.entity_id

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Process Path", "Parent Process Name", "Command Line" FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Sysmon')
AND "Parent Process Name" ILIKE '%w3wp.exe%'
AND "Parent Command Line" ILIKE '%SharePoint%'
AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%cscript.exe%' OR "Process Name" ILIKE '%wscript.exe%' OR "Process Name" ILIKE '%mshta.exe%' OR "Process Name" ILIKE '%certutil.exe%' OR "Process Name" ILIKE '%rundll32.exe%' OR "Process Name" ILIKE '%regsvr32.exe%')
LAST 24 HOURS

_sourceCategory=*windows*sysmon* OR _sourceCategory=*edr*
| where EventID=1
| where ParentImage matches "*w3wp.exe*" and ParentCommandLine matches "*SharePoint*"
| where Image matches "*cmd.exe*" or Image matches "*powershell.exe*" or Image matches "*cscript.exe*" or Image matches "*wscript.exe*" or Image matches "*mshta.exe*" or Image matches "*certutil.exe*" or Image matches "*rundll32.exe*" or Image matches "*regsvr32.exe*"
| count by host, ParentImage, Image, CommandLine, User
| sort -_count

rule sharepoint_deserialization_cve_2026_58644 {
  meta:
    author = "df00tech"
    description = "Detects suspicious child process execution from SharePoint w3wp.exe consistent with CVE-2026-58644 exploitation"
    severity = "CRITICAL"
    cve = "CVE-2026-58644"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.file.full_path = /w3wp\.exe/ nocase
    $proc.principal.process.parent_process.command_line = /SharePoint/ nocase
    $proc.target.process.file.full_path = /(cmd\.exe|powershell\.exe|cscript\.exe|wscript\.exe|mshta\.exe|certutil\.exe|rundll32\.exe|regsvr32\.exe)/ nocase
  match:
    $proc over 5m
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName="w3wp.exe"
| ParentCommandLine="*SharePoint*"
| in(field="FileName", values=["cmd.exe","powershell.exe","cscript.exe","wscript.exe","mshta.exe","certutil.exe","rundll32.exe","regsvr32.exe","net.exe","whoami.exe"], ignoreCase=true)
| table([ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, timestamp])
| sort(timestamp, order=desc)